Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Fuzzing between the lines in popular barcode software

blog.trailofbits.com | blog | #memory-safety | #denial-of-service | #fuzzing | #code-execution | #zbar | #barcode

Summary

Trail of Bits fuzzed the ZBar barcode library despite a limited time budget, uncovering an out-of-bounds stack write that can enable code execution and a memory leak usable for denial of service.
Published
Collected

original ↗

Related coverage

  1. Hack the Elephant One Bite at a Time: NUL byte SQL Injection in pdo_firebird and NULL Pointer Dereference in PDO via pdo_pgsql (swarm.ptsecurity.com)
  2. Attack arithmetic: how an integer overflow in PostgreSQL libpq leads to denial of service (swarm.ptsecurity.com)
  3. Remote Denial-of-Service on CycloneTCP : CVE-2021-26788 (blog.quarkslab.com)
  4. A “proof” of Fermat’s Last Theorem that fits the margin (blog.trailofbits.com)
  5. Use GWP-ASan to detect exploits in production environments (blog.trailofbits.com)
  6. Sanitize your C++ containers: ASan annotations step-by-step (blog.trailofbits.com)

back